Once upon a time, your business reputation resulted mainly from your own actions and words—and those of your customers. But that’s an old story. Today, business reputation also hinges on the behavior of your employees. And when their words or deeds are insulting, harassing, or demeaning—and begin to replicate virally on social media—watch out!

Employee rants have become common on the Internet. According to Nolo, a legal website for consumers and small businesses, employees are acting out on Facebook, G+, and other social-networking sites. Consider these high-profile examples:

An employee of a restaurant chain puts cheese up his nose, then places it on pizza being cooked for a customer, all captured on a YouTube video.

Another restaurant shift supervisor is captured on video saying, “I literally hate customers more than anything in the entire world. . . . They’re terrible. It’s all about them all the time.”

An employee of an auto club posts comments on MySpace about coworkers’ weight and sexual orientation, along with plans to slow down the company’s roadside assistance program.

Another employee threatens to punch a colleague in the face “before the end of my shift.”

And a bartender unhappy about not getting a raise in five years posts about his “redneck” customers on Facebook, wishing they choked on glass as they drive home drunk.

Would you reprimand or fire an employee for acting this way? No doubt. And you might expect the law to back you up, especially since your company has a written social-media policy. Think again!

Over the last several years, the National Labor Relations Board (NLRB) has issued several rulings that clarify employee freedom of speech online. Essentially what they’ve done is apply Section 7 of the National Labor Relations Act (NLRA) to online social media. Under that section, employees for decades have had the right to organize, join, or assist labor unions. They also have the right to engage in what NLRB calls “protected concerted activity”—i.e., discussions between employees designed to enhance working conditions or pay.

What’s different now is that online “concerted activity” is protected as well as offline activity. And employees don’t have to be union members to receive such protection.

Under this reading of NLRA, employers may not fire someone for making negative, insulting, or even disparaging remarks as long as they occurred between multiple employees engaged in concerted activity. But if the person’s rants have nothing to do with pay or working conditions and do not involve other employees, then the employer can discipline the person legally.

Several cases illustrate how NLRB’s rules work in practice. At Hispanics United of Buffalo, a New York nonprofit organization, an employee threatened to turn in other employees she thought weren’t working hard enough. A second employee asked colleagues on FB what they thought of the threat. They responded with angry, obscene rants claiming they were already working hard enough. When the employer heard of this exchange, it fired the five employees for harassing the first one. When the employees sued, NLRB found that Hispanics United fired the employees illegally because they were engaged in “concerted activity.”

A similar case occurred in Meriden, Connecticut, where a supervisor asked an employee of American Medical Response to prepare a written report regarding her job performance. The employee, a union member, asked for her union representative to be present while she wrote the report. The supervisor denied her request. After filing the report and going home, she posted derogatory and obscene Facebook comments about her supervisor. Other employees read and reacted to her post. Again, the employer discovered the posts and fired the employee for unprofessional conduct. NLRB responded with an unfair labor practice complaint, claiming that the Facebook posts were protected speech. The employer settled out of court, agreeing to revise its social-media policy, although the employee decided not to return to the company.

However, the “concerted activity” doctrine isn’t unlimited. Another case involved the unhappy bartender mentioned earlier. The person was not only unhappy about not getting a raise, but he also felt he was doing waitresses’ work for them without getting a share of their tips. The problem was that he discussed his feelings (and customer rants) with his stepsister on Facebook. So even though they were talking about working conditions, the NLRB found there was no “concerted activity” because no other employee was involved.

So how can you protect yourself in this employee-empowered environment? Here’s some advice from leading employment-law experts:

Understand that you still have the right to manage employee behavior on the job and while using your computers and IT networks. But recognize that your rights are more limited when employees use their own computers after hours.

If you don’t have a social media policy, develop one as soon as possible, with the input of a good employment law attorney. If you already have a policy, ask your attorney to make sure it’s consistent with current NLRB rules.

Be sure to prohibit harassment, bullying, discrimination or retaliation, at work or at home. But make sure your policy is written narrowly enough so that it doesn’t chill protected speech.

Advise employees that their default response to any workplace dispute should be bringing the problem to their supervisor or to Human Resources, not taking their gripe online.

Be clear about the types of posts you deem to be inappropriate. For example, make sure employees understand you will not tolerate threats of violence or discriminatory comments online.

Make sure to prohibit use of your computers or networks to publish personal content, either during or after work hours.

Remind employees that your offline code of conduct also applies to online behavior. In other words, employees should refrain from using the company’s name and marks, they should never disclose trade secrets or other confidential business information, and they should avoid making personal attacks on colleagues or customers.

Finally, do your best to prevent employee complaints by seeking their input, providing the resources they need to perform at a high level, and by paying them fairly. And when employees have complaints—and they will—give them a way to inform you of their concerns and have a process for resolving their issues in a reasonable time frame.

By preventing complaints and dealing with them expeditiously when they do occur, you’ll avoid Facebook or Twitter nightmares involving cheesy employees. Life is too short to deal with people like that!